FTC Report Lays 'Do Not Track' Responsibilities on Data Brokers

WASHINGTON, D.C. – The Federal Trade Commission (FTC) has stopped short of calling for a new “Do Not Track” law, instead saying Congress should enact a law that “would provide consumers with access to information about them held by a data broker (such as Lexis Nexis or U.S. Search),” according to an official statement released Monday by the commission.

The FTC’s final report called on companies handling consumer data to implement recommendations for protecting privacy, adding that the “industry has made significant process.”

“If companies adopt our final recommendations for best practices – and many of them already have – they will be able to innovate and deliver creative new services that consumers can enjoy without sacrificing their privacy,” said Jon Leibowitz, chairman of the FTC. “We are confident that consumers will have an easy to use and effective Do Not Track option by the end of the year because companies are moving forward expeditiously to make it happen and because lawmakers will want to enact legislation if they don’t.”

Rather than calling for a direct Do Not Track law, the FTC recommended that companies enact the following policies:
• Privacy by Design: Companies should build in consumers’ privacy protections at every stage in the development of their products, including reasonable security for consumer data, limited collection and retention of data and reasonable procedures to promote data accuracy.
• Simplified Choice for Businesses and Consumers: Consumers should be given the choice to decide what information is shared about them, and with whom, via an easily understandable Do Not Track mechanism they can use to control the tracking of online activities.
• Greater Transparency: Companies should disclose details about their collection and use of consumers’ information, as well as provide consumers with access to that data.

The final report changes the guidance’s scope, according to the FTC.

“The preliminary report recommended that the proposed framework apply to all commercial entities that collect or use consumer data that can be linked to a specific consumer, computer or other device. Recognizing the potential burden on small businesses, the report concludes that the framework should not apply to companies that collect and do not transfer only non-sensitive data from fewer than 5,000 consumers a year,” the FTC report read. “The report also responds to comments filed by organizations and individuals that, with technological advances, more and more data could be ‘reasonably linked’ to consumers, computers or devices. The final report concludes that data is not ‘reasonably linked’ if a company takes reasonable measures to de-identify the data, commits not to re-identify it, and prohibits downstream recipients from re-identifying it.”

The American Civil Liberties Union (ACLU) applauded the FTC report, according to a CNET report.

“These brokers’ business model is built on the violation of consumer privacy,” said Christopher Calabrese, ACLU legislative counsel. “Not only are they the backbone of a flawed background check industry, these data brokers also provide much of the information that is shared with behavioral targeters and the government.”